TL;DR: Choose CISA (Certified Information Systems Auditor) if your work is auditing, assurance or testing IT controls. Choose CRISC (Certified in Risk and Information Systems Control) if your work is identifying, assessing and responding to IT risk. The two exams share the same format (150 multiple-choice questions, 4 hours, passing score of 450 on a 200 to 800 scale) and the same fee (USD 575 for ISACA members, USD 760 for non-members), so cost and format will not decide it. The experience requirement will: CISA asks for 5 years of auditing, control or security experience, while CRISC asks for 3 or more years across at least two of its four domains. Many people in audit and risk teams end up holding both, and neither is a prerequisite for the other.
Quick Facts
| Item | CISA | CRISC |
| Full name | Certified Information Systems Auditor | Certified in Risk and Information Systems Control |
| Core focus | IT audit, assurance and control testing | IT risk identification, assessment, response and reporting |
| Exam questions | 150 multiple choice | 150 multiple choice |
| Duration | 4 hours | 4 hours |
| Passing score | 450 on a 200 to 800 scale | 450 on a 200 to 800 scale |
| Exam fee (member) | USD 575 | USD 575 |
| Exam fee (non-member) | USD 760 | USD 760 |
| Domains | 5 | 4 |
| Required experience | 5 years of professional information systems auditing, control or security work | 3 or more years of CRISC work experience across at least two of the four domains |
| Experience window | Within the 10 years before the application date | Within the 10 years before the application date |
| Time to apply after passing | 5 years | 5 years |
| Application processing fee | USD 50 (one time) | USD 50 (one time) |
| CPE to maintain | 20 per year, 120 per 3-year period | 20 per year, 120 per 3-year period |
| Delivery | PSI test center or remotely proctored | PSI test center or remotely proctored |
Figures come from ISACA’s CISA and CRISC pages, its exam content outlines and its exam candidate guide, checked in November 2026. ISACA changes fees and requirements, so confirm on the official page before you register.
What Each Certification Is For
CISA: Proving IT systems are controlled and auditable
CISA is built around the work of an IT auditor. It covers how audits are planned and run, how IT is governed and managed, how systems are acquired and developed, how operations and resilience are kept up, and how information assets are protected. The question style tests whether you can judge control design and audit evidence, not just define terms.
Typical roles: IT auditor, internal auditor with a technology focus, compliance analyst, assurance consultant, risk and control reviewer.
CRISC: Managing IT risk as a business problem
CRISC focuses on the risk practitioner’s work: understanding governance, assessing and evaluating risk, deciding on responses, and reporting on risk and controls. It is about helping the business decide what to accept, mitigate, transfer or avoid, and how to keep risk information accurate and useful.
Typical roles: IT risk analyst, risk manager, GRC analyst, control owner, security risk consultant.
A short way to hold the difference: CISA asks “are the controls working and can I prove it?” while CRISC asks “what could go wrong, how bad would it be and what should we do about it?”
Exam Domains and Weights Side by Side
| CISA domain (current outline) | Weight |
| Information Systems Auditing Process | 18% |
| Governance and Management of IT | 18% |
| Information Systems Acquisition, Development and Implementation | 12% |
| Information Systems Operations and Business Resilience | 26% |
| Protection of Information Assets | 26% |
| CRISC domain (current outline) | Weight |
| Governance | 26% |
| Risk Assessment | 22% |
| Risk Response and Reporting | 32% |
| Technology and Security | 20% |
What the weights tell you:
- CISA leans technical and operational. Operations and resilience plus protection of information assets make up 52% of the exam.
- CRISC leans on response and reporting. Risk Response and Reporting is the largest domain at 32%, and Governance adds another 26%.
- Governance appears in both, but in different shapes. In CISA it is about governing and managing IT. In CRISC it is the foundation for how risk is owned and decided.
- Both exams cover security, but CISA tests whether controls protect assets, while CRISC tests whether security and technology risk is understood and treated.
The exam outline pages reviewed for both certifications did not mention an upcoming change, but ISACA updates outlines from time to time. Download the current outline from ISACA before you build a study plan. If you are comparing ISACA exams on timing, see our CISM exam changes guide for how ISACA handles outline updates.
Experience Requirements: The Real Decision Factor
Passing the exam is not the whole path. ISACA requires you to apply for certification after you pass and show relevant experience.
| CISA | CRISC | |
| Minimum experience | 5 years of professional information systems auditing, control or security work | 3 or more years of CRISC work experience across at least two of the four domains |
| Window | Gained within the 10 years before the application date | Gained within the 10 years before the application date |
| Time to apply after passing | 5 years | 5 years |
| Processing fee | USD 50 | USD 50 |
Points to note:
- You can take the exam before you have the experience. ISACA gives you five years from the passing date to apply, so some candidates sit the exam early and finish the experience requirement later. Until you are certified, you cannot use the designation.
- CRISC asks for less time but across more specific domains. Three years sounds easier than five, but the work must fall in at least two of the four CRISC domains.
- CISA has a longer requirement. The CISA pages reviewed did not list any waivers or substitutions, so check ISACA’s current requirements article before you assume any experience can be substituted.
- Document your experience early. Verification by an employer or supervisor takes time, so start collecting details while you study.
If you are early in your career, the CRISC route is the shorter experience path on paper. If you already have five years in audit or control work, CISA is the more direct match for your background.
Exam Format, Scoring and Retakes
Both exams share the same logistics, according to ISACA’s exam candidate guide:
- Questions and time: 150 multiple-choice questions in 4 hours.
- Scoring: Scores are reported on a common scale from 200 to 800, and you need 450 or higher to pass. Pretest items do not count toward your score, and there is no penalty for wrong answers, so answer every question.
- Delivery: Computer-based at authorized PSI testing centers, or remotely proctored from home.
- Eligibility window: Six months from the registration date. You can schedule as early as 48 hours after paying, and appointments open up to 90 days in advance. A six-month extension costs USD 75 and can be purchased once.
- Rescheduling: Free during the eligibility period if done at least 48 hours before the appointment. Inside 48 hours you take the exam or forfeit the fee.
- Fees: USD 575 for ISACA members and USD 760 for non-members, nonrefundable and nontransferable.
- Retakes: Four attempts within a rolling 12-month period. You wait 30 days after the first attempt and 90 days after each later attempt, and the full fee is due every time.
Because the retake rules are strict and the fee is high, a failed attempt costs both money and months. Treat the first attempt as the one you plan to pass.
Cost: One Exam, Both Exams, and Maintenance
| Item | Member | Non-member |
| One exam (CISA or CRISC) | USD 575 | USD 760 |
| Both exams | USD 1,150 | USD 1,520 |
| Application processing fee per certification | USD 50 | USD 50 |
| One six-month eligibility extension | USD 75 | USD 75 |
| CISA annual maintenance fee | USD 45 per year | USD 85 per year |
The CRISC pages reviewed did not list an annual maintenance fee, so confirm it in MyISACA. For CISA, the fee is due by 1 January and covers renewal through the calendar year. Add study materials, courses and any ISACA membership cost to your budget, and check the current membership price on ISACA’s site. For a wider comparison of what audit and compliance credentials cost, see our audit and compliance certification exams guide.
Keeping the Certification: CPE
Both certifications use the same continuing professional education model:
- 20 CPE hours per year and 120 CPE hours over a 3-year reporting period.
- Reporting: ISACA-tracked CPE is loaded into your account, but you must apply it to your certification before it counts. CPE from chapters or other organizations is self-reported through MyISACA.
- Annual fee: Due by 1 January for CISA (see the cost table).
If you plan to hold both, check ISACA’s CPE policy for how hours are counted across certifications before you plan your reporting.
How Hard Is Each Exam?
ISACA does not publish pass rates, so treat any pass rate you see quoted as unofficial. A practical way to think about difficulty:
- CISA difficulty comes from breadth. Five domains cover audit method, governance, development lifecycle, operations and security. Candidates without hands-on audit experience often struggle with the “what would the auditor do first” style of question.
- CRISC difficulty comes from judgment. Many answers are plausible, and the best one reflects the business view of risk, not the purely technical one. Candidates from a pure technical background sometimes find this harder than expected.
- Common ground: both reward reading the question for the role and context. Ask whether you are being asked as an auditor, a risk practitioner or a manager.
Which Should You Take? A Decision Framework
Take CISA first if:
- You work in or want to move into IT audit, internal audit or assurance.
- You have 5 years of auditing, control or security experience, or will soon.
- Your employer or clients ask for CISA by name.
- You want a credential recognized across audit and compliance job listings.
Take CRISC first if:
- You work in IT risk, GRC, risk management or security risk.
- You have 3 or more years of work in at least two CRISC domains.
- Your job is to assess and report risk to managers, not to test controls.
- You want to move toward a risk management or governance role.
Consider CISM or CGEIT instead if:
- You manage a security program (CISM) or you set IT governance direction (CGEIT). Our CISA vs CISM guide, CRISC vs CISM guide and CGEIT vs CRISC guide cover those comparisons.
Consider CIA alongside CISA if:
- You work in internal audit more broadly. See our CIA vs CISA guide.
Take both if:
- You are building a career in audit and risk together, such as an internal audit or GRC function that does both assurance and risk work. The order is your choice: take the one that matches your current work and experience first.
Do You Need CISA Before CRISC, or the Other Way Round?
No. ISACA’s pages list the same exam format for both, and the certification pages describe separate experience requirements, with no prerequisite exam. You can register for either exam without holding the other. Holding one does not shorten the other’s experience requirement.
A Practical Study Plan
These are suggestions, not ISACA requirements. Adjust for your experience.
For CISA
- Download the current exam content outline and use its five domains as your checklist.
- Spend the most time on operations and resilience and on information asset protection. Together they carry 52% of the exam.
- Practice audit reasoning. For each scenario, ask what the auditor should do first, what evidence matters and what the report should say.
- Do timed practice sets. 150 questions in 4 hours is about 96 seconds per question, so practice pacing.
- Track your experience as you go, since you will need it for the application.
For CRISC
- Download the current exam content outline and map your gaps against the four domains.
- Spend the most time on risk response and reporting (32%) and governance (26%).
- Practice choosing a response. For each scenario, decide whether the best answer is to accept, mitigate, transfer or avoid, and why.
- Think like the risk owner, not the control tester. The best answer usually serves the business objective and the risk appetite.
- Do timed practice sets to build pacing for the 4-hour exam.
For an overview of other audit and risk credentials to compare, see our most rewarding IT auditing certifications ranking and our best cybersecurity certifications guide. If you are tracking ISACA’s newer AI credentials, our ISACA AAIR guide compares AAIR with CRISC.
Common Mistakes to Avoid
- Assuming passing the exam makes you certified. You must also apply, show experience and pay the USD 50 processing fee within 5 years of passing.
- Underestimating the experience rules. CISA needs 5 years in auditing, control or security. CRISC needs 3 or more years across at least two of its four domains.
- Rescheduling inside 48 hours. You forfeit the fee.
- Ignoring the retake rules. You have four attempts in 12 months, with 30 and 90 day waits.
- Studying CISA like a security exam. It rewards audit judgment, not just technical depth.
- Studying CRISC like a technical exam. It rewards business-aware risk decisions.
- Letting CPE slip. You need 20 hours a year and 120 over three years.
- Using an old outline. Download the current outline before you start.
FAQ
What is the difference between CISA and CRISC?
CISA is an IT audit and assurance certification that proves you can assess and test IT controls. CRISC is an IT risk certification that proves you can identify, assess, respond to and report on IT risk. Both use the same exam format and fee.
Which is better, CISA or CRISC?
Neither is better overall. CISA fits audit and assurance roles, and CRISC fits risk and GRC roles. Choose based on what your job or target job asks for.
Should I take CISA or CRISC first?
Take the one that matches your current work and experience. If you have 5 years in audit, control or security work, CISA is the direct match. If you work in risk and have 3 or more years across at least two CRISC domains, start with CRISC.
How much do the CISA and CRISC exams cost?
Each exam costs USD 575 for ISACA members and USD 760 for non-members. Both also require a one-time USD 50 application processing fee after you pass.
How many questions are on the CISA and CRISC exams?
Both have 150 multiple-choice questions and a 4-hour time limit.
What is the passing score for CISA and CRISC?
You need 450 or higher on a scale of 200 to 800. Pretest items do not count toward your score, and wrong answers carry no penalty.
How much experience do I need for CISA?
A minimum of 5 years of professional information systems auditing, control or security work, gained within the 10 years before you apply.
How much experience do I need for CRISC?
3 or more years of CRISC work experience across at least two of the four CRISC domains, gained within the 10 years before you apply.
Can I take the CISA or CRISC exam before I have the experience?
Yes. ISACA gives you five years from the passing date to apply for certification, though you cannot use the designation until you are certified.
How long do I have to take the exam after registering?
Six months from the registration date. A one-time six-month extension costs USD 75, and rescheduling is free if done at least 48 hours before your appointment.
How often can I retake the CISA or CRISC exam?
You get four attempts within a rolling 12-month period, with a 30 day wait after the first attempt and 90 days after each later attempt. The full fee applies each time.
How do I maintain CISA or CRISC?
Earn 20 CPE hours a year and 120 over a 3-year period, and report them through MyISACA. CISA also has an annual maintenance fee (USD 45 for members and USD 85 for non-members), and you should confirm the CRISC fee in MyISACA.
Do I need both CISA and CRISC?
Not usually. Many professionals hold one, and people in combined audit and risk functions sometimes hold both. Choose the one your role needs first and add the other if your career moves that way.
Final Thoughts
The deciding factor between CISA and CRISC is the work you do, not the exam, since the format and fee are the same. If you test and report on controls, CISA fits. If you assess and manage risk, CRISC fits. Check your experience against each requirement before you register, plan around the strict retake rules, and download the current outline from ISACA’s CISA certification page and its CRISC counterpart before you start studying, since fees, outlines and policies can change.
